TVT NVMS-1000 Directory Traversal Vulnerability

Timeline

Detection, updates, and resolution for this record.

1. Dec 29, 2019 · Catalog

   Detected

   TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 3, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests.

Affected

• cpe tvt/nvms-1000 firmwareversion unspecified
• vendor TVT NVMS-1000version unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2019-20085

  TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests.

  cisa.gov
• CVE.orgVulnerability recordCVE-2019-20085

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2019-20085

  30-day exploitation probability 96.1%

  first.org
• Exploit DatabasePublic exploit reference48311

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Metasploit ModulesPublic exploit moduleauxiliary_scanner/http/tvt_nvms_traversal

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2019-20085

  TVT NVMS-1000 devices allow GET /.. Directory Traversal

  nvd.nist.gov
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/157196/TVT-NVMS-1000-Directory-Traversal.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Exploit · exploit-db.com